diff --git a/composer.lock b/composer.lock
index 594ef33e428..615ca089ffd 100644
--- a/composer.lock
+++ b/composer.lock
@@ -58,42 +58,6 @@
             ],
             "time": "2017-12-20T14:37:45+00:00"
         },
-        {
-            "name": "brumann/polyfill-unserialize",
-            "version": "v1.0.4",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/dbrumann/polyfill-unserialize.git",
-                "reference": "8ed1cd343ddc134a7ef649aca0aa0fe2a1b45008"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/dbrumann/polyfill-unserialize/zipball/8ed1cd343ddc134a7ef649aca0aa0fe2a1b45008",
-                "reference": "8ed1cd343ddc134a7ef649aca0aa0fe2a1b45008",
-                "shasum": ""
-            },
-            "require": {
-                "php": "^5.3|^7.0"
-            },
-            "type": "library",
-            "autoload": {
-                "psr-4": {
-                    "Brumann\\Polyfill\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Denis Brumann",
-                    "email": "denis.brumann@sensiolabs.de"
-                }
-            ],
-            "description": "Backports unserialize options introduced in PHP 7.0 to older PHP versions.",
-            "time": "2019-07-14T23:16:24+00:00"
-        },
         {
             "name": "composer/installers",
             "version": "v1.7.0",
@@ -689,7 +653,7 @@
             "dist": {
                 "type": "path",
                 "url": "core",
-                "reference": "ed8f9b919e4154bfeb3b0e7109e63fde94cfec01"
+                "reference": "f5caa987fc01923d57a6dba206ad8207c073beab"
             },
             "require": {
                 "asm89/stack-cors": "^1.1",
@@ -732,7 +696,7 @@
                 "symfony/validator": "~3.4.0",
                 "symfony/yaml": "~3.4.5",
                 "twig/twig": "^1.38.2",
-                "typo3/phar-stream-wrapper": "^2.1.1",
+                "typo3/phar-stream-wrapper": "^3.1.2",
                 "zendframework/zend-diactoros": ">=1.7 <1.8",
                 "zendframework/zend-feed": "^2.12"
             },
@@ -3111,31 +3075,35 @@
         },
         {
             "name": "typo3/phar-stream-wrapper",
-            "version": "v2.1.2",
+            "version": "v3.1.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/TYPO3/phar-stream-wrapper.git",
-                "reference": "057622f5a3b92a5ffbea0fbaadce573500a62870"
+                "reference": "df7609a2f6cc4013d7bd12f1a2412d127b28f771"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/TYPO3/phar-stream-wrapper/zipball/057622f5a3b92a5ffbea0fbaadce573500a62870",
-                "reference": "057622f5a3b92a5ffbea0fbaadce573500a62870",
+                "url": "https://api.github.com/repos/TYPO3/phar-stream-wrapper/zipball/df7609a2f6cc4013d7bd12f1a2412d127b28f771",
+                "reference": "df7609a2f6cc4013d7bd12f1a2412d127b28f771",
                 "shasum": ""
             },
             "require": {
-                "brumann/polyfill-unserialize": "^1.0",
                 "ext-json": "*",
-                "php": "^5.3.3|^7.0"
+                "php": "^7.0"
             },
             "require-dev": {
                 "ext-xdebug": "*",
-                "phpunit/phpunit": "^4.8.36"
+                "phpunit/phpunit": "^6.5"
             },
             "suggest": {
                 "ext-fileinfo": "For PHP builtin file type guessing, otherwise uses internal processing"
             },
             "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "v3.x-dev"
+                }
+            },
             "autoload": {
                 "psr-4": {
                     "TYPO3\\PharStreamWrapper\\": "src/"
@@ -3153,7 +3121,7 @@
                 "security",
                 "stream-wrapper"
             ],
-            "time": "2019-05-14T13:14:31+00:00"
+            "time": "2019-05-14T13:14:14+00:00"
         },
         {
             "name": "wikimedia/composer-merge-plugin",
diff --git a/core/composer.json b/core/composer.json
index e64836bc5b5..438d4312b3b 100644
--- a/core/composer.json
+++ b/core/composer.json
@@ -31,7 +31,7 @@
         "symfony/process": "~3.4.0",
         "symfony/polyfill-iconv": "^1.0",
         "symfony/yaml": "~3.4.5",
-        "typo3/phar-stream-wrapper": "^2.1.1",
+        "typo3/phar-stream-wrapper": "^3.1.2",
         "twig/twig": "^1.38.2",
         "doctrine/common": "^2.7",
         "doctrine/annotations": "^1.4",
diff --git a/core/lib/Drupal/Core/Security/PharExtensionInterceptor.php b/core/lib/Drupal/Core/Security/PharExtensionInterceptor.php
index a13e8ce8192..0d8e8e8304c 100644
--- a/core/lib/Drupal/Core/Security/PharExtensionInterceptor.php
+++ b/core/lib/Drupal/Core/Security/PharExtensionInterceptor.php
@@ -31,7 +31,7 @@ class PharExtensionInterceptor implements Assertable {
    * @throws \TYPO3\PharStreamWrapper\Exception
    *   Thrown when the file is not allowed to execute.
    */
-  public function assert($path, $command) {
+  public function assert(string $path, string $command): bool {
     if ($this->baseFileContainsPharExtension($path)) {
       return TRUE;
     }